Questions before you text

Inquiries Text First Then Call: 801.319.1061. There is no form and no account to create. Robert Foster, President and CEO, reads the note and answers the phone. The firm is based in Utah. Tell us the security or IT operations problem. Engagements are remote-first across the U.S., and on-site travel is available. We work around your normal operations, and we'll need access to the right areas and the right people while we do.

There is no fee. Robert Foster says whether the work is a fit. Once you approve a written scope, we'll need access to the right areas and people. The consult is that text or that call.

Access to the right areas and the right people during normal operations. That usually means the systems the work would cross and the people who run them. For an incident, that is the plan if one exists and the people who would be called. For ISO 27001 readiness or a penetration test, that is the control owners, the operators, and the people who can approve activity during the window. We cannot write a usable plan, or close a finding, from a note alone.

REKKY Sec Ops Consulting is the security and IT operations firm of REKKY Consulting LLC, a Utah limited liability company based in Pleasant Grove. Robert Foster, President and CEO, served in the United States Marine Corps and has directed technology and field teams in medical devices under FDA and ISO requirements, in energy and telecommunications networks, and in security platforms. Shane Matthew Foster is Vice President and CTO. Serving clients across the U.S. Engagements are remote-first, and on-site travel is available.

We write the scope before the work starts. Once you approve it, we'll need access to the right areas and people. We follow one job through identity, network, platforms, access, and records, including capacity and whether a restore has been done. You receive what already holds, what disagrees, and the order to close it.

After the assessment, we close the gaps that stall the week. A named person on each duty, reviews that still change the work, and records that match the controls, including SOC 2 or PCI. We leave when your team can run the next week. The record stays with you. We do not leave a system that needs us in the meeting.

The Recon Assessment starts at $15,000 plus expenses. Four days on site with your team, then a written report within about two weeks. The free consult has no fee. The facility assessment is a fixed fee paid in full before the visit is scheduled. That amount is not published on this site. It is part of the reply. Other work is scoped in writing before it starts, and those fees stay in that scope.

We review the operation as it is actually run. The review covers the systems we can reach, the people who operate them, and the leadership that owns the decisions. You receive a written account of what needs attention. We work around your normal operations, and we'll need access to the right areas and the right people while we do.

Security, quality, and infrastructure are examined as one system, from hardware and networks through cloud and data. ISO 27001 readiness is treated as an operating requirement. Penetration testing follows the paths that matter and is followed by remediation until findings are closed and retested. Implementation, contract support, and hiring that follow the findings are agreed separately.

The facility assessment is a fixed engagement. The fee is paid in full before the visit is scheduled. That amount is not published on this site. It is part of the reply.

No. The work is ISO 27001 readiness: evidence that can be produced, owners who understand their duties, and gaps addressed before an assessment. An external assessor issues a certificate, if one is issued.

Testing follows paths an attacker would use and stays on the paths that matter. After findings are corrected, the same paths are tested again. A finding without a retest stays open in the written account. We need access to the right areas and the right people during the window.

The plan, tabletop exercises, playbooks, ransomware readiness, breach readiness, and backup and recovery testing. Security operations, infrastructure assessment, ISO 27001 readiness, and penetration testing are on this site too. We do not sell a 24-hour response retainer and we do not quote a response time.

No. REKKY Sec Ops Consulting does not sell a 24-hour retainer and does not quote a response time. We will not take the keyboard during a live breach. Incident response readiness on this site names the owners, the access you can revoke, and a week your team can run. If you need a forensics firm tonight, say so in the first note.

No. Payment is your decision, made with your counsel and your insurer if you have one. We will not contact an attacker. Whether a notice is required is a legal question for your counsel. We help you name who holds each decision and which facts the timeline has to hold.

Not as the opening move. We name a platform owner first. If the week is still short after that record, contract support or a hire can be scoped separately, and we'll need access to the right areas and people. An ongoing fractional DevOps or SRE placement is the Coalesce Ops practice.

Cybersecurity consulting and IT operations for clients across the U.S. Engagements are remote-first, and on-site travel is available. SOC 2 and PCI readiness. ISO 27001 readiness. Penetration testing with retest. An infrastructure assessment. IT operations: platforms, runbooks, change control, and monitoring. Incident response plans, tabletops, playbooks, ransomware readiness, breach readiness, and backup and recovery testing. Onboarding, offboarding, and the evidence. AI only on a step people already do. An ongoing fractional DevOps or SRE placement is Coalesce Ops.

No. REKKY Sec Ops Consulting is a consulting practice. We work around your normal operations, and we'll need access to the right areas and the right people while we do. The work is specific to the environment you run.

You do. Owners, reviews, access records, the plan, the playbooks, the exercise record, the restore result, and the retest record stay with the company. We leave when the people you have can run the next week. We do not leave a system that needs us in the meeting, and we do not keep a standing login.

It is used to reply about the work. It is not sold, it is not added to a marketing list, and it is not turned into a public testimonial, a logo, or a client count. This site does not publish client names.